Errata entry needed for STM32F3

[gfuehrer]

Posted on June 07, 2013 at 00:37

For DMA_CCRx, halfword and byte write access is broken. In both cases, an interrupt is generated on the instruction following the write instruction. Also, if a byte is written to [15:8], the value is replicated to [7:0].

Here's firmware that reproduces this on STM32F373VCT6-B and STM32F303VCT6-Y:

08000188 <
Undefined_Handler
>: 
8000188: e7fe b.n 8000188 <
Undefined_Handler
> 
800018a: 0000 movs r0, r0 
0800018c <
Reset_Handler
>: 
// RCC->AHBENR |= RCC_AHBENR_DMA1EN; 
800018c: 4b04 ldr r3, [pc, #16] ; (80001a0 <
Reset_Handler
+0x14>) 
800018e: 695a ldr r2, [r3, #20] 
8000190: f042 0001 orr.w r0, r2, #1 
8000194: 6158 str r0, [r3, #20] 
// ((__IO uint8_t*)&DMA1_Channel4->CCR)[1] = 0x7A; 
8000196: 4b03 ldr r3, [pc, #12] ; (80001a4 <
Reset_Handler
+0x18>) 
8000198: 217a movs r1, #122 ; 0x7a 
800019a: 7019 strb r1, [r3, #0] 
// for (;;) { } 
800019c: e7fe b.n 800019c <
Reset_Handler
+0x10> 
800019e: bf00 nop 
80001a0: 40021000 .word 0x40021000 
80001a4: 40020045 .word 0x40020045 

The processor ends up in the Undefined_Handler instead of at the for(;;) loop. And the value in

DMA1_Channel4->CCR

is 0x00007A7A (should be 0x00007A00). The workarround is obvious -- only write to DMA_CCRx as 32bit word. -Gary #defect-stm32f3

[Tesla DeLorean]

Posted on June 07, 2013 at 01:42

I suspect there are large tracts of peripheral register space that don't work with partial and/or unaligned write accesses, it's not expected to act like regular RAM with byte lanes, or operate on the same register in some cases (USARTx->DR).

[frankmeyer9]

Posted on June 07, 2013 at 08:17

Basically true, but if ST writes in RM0313:

10.5       DMA registers

Refer to Section 1.1 on page 36 for a list of abbreviations used in register descriptions. The peripheral registers can be accessed by bytes (8-bit), half-words (16-bit) or words (32-bit). I would assume this to work if stated explicitly. Perhaps an issue of test coverage...

[waclawek.jan]

Posted on June 07, 2013 at 09:02

It appears that the DMA in 'F3xx is the same as in 'F1xx/'L1xx (but different from 'F2xx/'F4xx).

Could anybody please try if this flaw is present in 'F1xx/'L1xx too? JW

[zzdz2]

Posted on June 07, 2013 at 09:41

The peripheral registers can be accessed by bytes (8-bit), half-words (16-bit) or words (32-bit).

Maybe they meant that the peripheral registers handled by DMA engine can be 8,16 or 32-bit, not the DMA registers themselves. Who knows.

[waclawek.jan]

Posted on June 07, 2013 at 10:09

No. This refers to the DMA module's registers.

Every ''registers'' subchapter in the UMs starts with describing how these registers can be accessed. The DMA registers subchapter in 'F2/'F4, for example, starts with ''The DMA registers can be accessed by words (32 bits).''. JW

[frankmeyer9]

Posted on June 07, 2013 at 10:23

Maybe they meant that ...

As this is no religious text, but a technical reference manual, there should be no guessing about the ''true meaning''. IMHO a demerit for ST ...

[zzdz2]

Posted on June 07, 2013 at 10:44

No. This refers to the DMA module's registers.

Yes, it is, but who knows where it came from. My guess is that it meant something different originally.Edit: It doesn't look like a hardware bug, definitely documentation problem.